This line is in iptables
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 53 -j ACCEPT
Do I need something more than port 53 ? it replies using telnet, but nslookup gives a timeout.
Server Fault is a question and answer site for system and network administrators. It only takes a minute to sign up.Sign up to join this community
As mentioned, see http://tools.ietf.org/html/rfc5966. To properly support DNS, you need to allow port 53 for both TCP and UDP. Failure to do so will result in much higher packet fragmentation, particularly with the introduction of IPv6 and DNSSEC (note that all version of BIND since 9.2 will indicate it supports DNSSEC even if you haven't configured DNSSEC (unless you compile it out)). This particularly sucks when people filter out fragments.